Citrix NetScaler Critical Auth Bypass in Gateway and AAA Configs

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Plan: A critical auth bypass in NetScaler ADC/Gateway is high-severity exposure for any org using these as VPN or AAA endpoints; no KEV listing or public PoC in signals, so patch to the latest Citrix-released version this cycle rather than emergency response.
SOC/IR — Learn: No active exploitation or IOCs reported yet; monitor for KEV addition or PoC release, at which point an assume-breach sweep of edge authentication logs would be warranted.
Leader — Skip

Citrix on CuraSec